On recent Linux kernels, the output of /dev/urandom
comes from the stream cipher ChaCha20. This output should never be used "as is" to encrypt data because OTP (and any stream cipher) is maleable. You must use an authenticated encryption schema, such as XChaCha20+poly1305.
Also, you must properly deal with key distribution and protection. How do you ensure that a one copy of an OTP is not tempered with so that the encrypted message is not read differently by the recipient? (The recipient can be the sender at a later date.) How do you ensure the USB key is not stollen, copied, then returned? I just stated 2 of the most obvious possible threats here, but many more exist.
I'm sorry, but your implementation of OTP is just poor man's cryptography, even if you used a true RNG. Far less secure in practice than a well design cryptographic protocol, despite your best intentions.
To solve your original question, you should do a proper rigorous risk assessment, to identify what you want to protect, against who, with what means, and at what cost (time, money, skill, resources, etc). Only then you will be able not properly design your security requirements and not overlook issues that could be exploited to bring you harm.
Also do not forget that your solution will be used by real humans who tend to naturally go the easy way: they will try to bypass any cumbersome security measure, even if they are put in place to protect them. A 16 Gb OTP on a USB key looks really cumbersome to me.